SMS is not 2FA-secure • Hacker News Board

Re: SMS is not 2FA-secure

#321

Post by mgbmtl » Sat, Jan 11, 2020, 6:50 PM UTC

Pxtl wrote: post #311

Nextgrid wrote: post #298

Earlier quoted context omitted.

This will do nothing to deter malicious SIM swaps. Someone who's happy to take over your number and then steal your money is also happy to present a fake ID and pretend to be you.

What kind of ID is it? A proper barcoded photo ID that corresponds to a government database? Because with that you can verify that the ID picture matches the one in the government database.

I don't live in Europe, but with Orange, I had to upload a photo of my EU passport (they didn't accept a non-EU passport to extend the lifespan of the SIM card).

Offtopic: those laws seem kind of silly if you can still get a valid SIM for 10 days without any ID. Seems more to be about surveillance than about anti-terrorism.

Re: SMS is not 2FA-secure

#322

Post by konschubert » Sat, Jan 11, 2020, 7:11 PM UTC

cortesoft wrote: post #180

tptacek wrote: post #21

This is great; it's a Princeton research project from Arvind Narayanan's (@random_walker) group, in which their team made 10 attempts to SIM-swap each of 5 different carriers, including T-Mobile, AT&T, and Verizon (all three of which were, weirdly, less secure in some ways than the 2 MVNOs they tested). Most notably: AT&T and Verizon both use call logs to authenticate SIM swaps from people who don't know the account…

So how SHOULD this problem be solved? How should account recovery work?

A sim transfer/ account recovery process should come with a transition period of multiple days during which SMSs with warnings are sent to the original sim card.

On top of that, one could think of: A passphrase to authenticate a number transfer to another sim.

Sending a code through physical mail.

Re: SMS is not 2FA-secure

#323

Post by irjustin » Sat, Jan 11, 2020, 7:35 PM UTC

GrinningFool wrote: post #93

irjustin wrote: post #84

Earlier quoted context omitted.

As another person said, you're literally leaving it everywhere you go. If you need a blood sample, then would donating blood be considered compromising security? Identity is what your DNA is. Password is a secret. Your DNA is not a secret.

I think requiring you to be physically present and having a human take the sample in a prescribed manner serves as an effective 'password' - unless it's a live sample, the DNA is useless.

I think there's a misunderstanding of what is possible with DNA[0]. We take DNA from dead stuff all the time.

I will agree with "you have to be physically present" is good enough password. This is Yubikey, which works fantastic. The problem with DNA is when it is compromised - you can't throw it away/change it without exorbant effort (bone marrow transplant? and then you're simply taking on someone else's identity? is that identity theft?).

[0] https://www.quora.com/Do-we-require-live-cells-when-extracti...

Re: SMS is not 2FA-secure

#324

Post by lrem » Sat, Jan 11, 2020, 7:38 PM UTC

lutorm wrote: post #160

kccqzy wrote: post #131

Earlier quoted context omitted.

After using TOTP like Google Authenticator since around 2013, I now think the friction needed is just too great. Especially for banks which log you out after 15 minutes or so of idleness. Google doesn't do that. Not to mention Google Authenticator deliberately prevents these stored tokens to be backed up and transferred to a different device, which makes upgrading devices troublesome. I wish everyone would start usin…

Isn't that solvable by not requiring 2fa for "registered" devices?

What about the device getting compromised?

Re: SMS is not 2FA-secure

#325

Post by dmoy » Sat, Jan 11, 2020, 7:48 PM UTC

Nextgrid wrote: post #307

dmoy wrote: post #40

Earlier quoted context omitted.

Backup access in a bank safety deposit box is what I do.

I read an article here some time ago that banks take no responsibility if they lose/destroy the contents of their boxes as someone learnt the hard way with precious family possessions.

Right that's why you should verify your backups every year.

No place you store your backup can guarantee it won't be lost or destroyed.

Re: SMS is not 2FA-secure

#326

Post by cbsmith » Sat, Jan 11, 2020, 7:51 PM UTC

trimbo wrote: post #191

I'm surprised more websites aren't taking advantage of TouchId. It's so easy for people to use. Even login.gov supports it! https://www.slashgear.com/chrome-is-adding-touch-id-and-fing...

While I like the principle of using WebAuthn, I'm a bit suspect of biometric based authentication.

Re: SMS is not 2FA-secure

#327

Post by SpaethCo » Sat, Jan 11, 2020, 8:21 PM UTC

jorvi wrote: post #179

Terretta wrote: post #158

Earlier quoted context omitted.

Don’t put them in google authenticator. https://support.1password.com/one-time-passwords/

Its great functionality but it reduces your security. Say someone somehow figures out your 1Password password and security key - if you store your OTPs in Authy, your passwords are useless (well, less useful anyway). If you store your OTPs in 1Password, they have the keys to the kingdom.

This is technically true, but the most likely scenarios that result in the discovery of your secret key (128bits of entropy) + master password (?? additional bits) involve things like a device compromise. If your machine is compromised, you’re probably already exposed to things like session cookie stealing. At that point your attack surface is already blown wide open.

The biggest thing 2FA protects against is credential stuffing. If you’re using a password manager and have high entropy site-unique passwords, the additional entropy by TOTP is mostly moot anyway.

Re: SMS is not 2FA-secure

#328

Post by ianamartin » Sat, Jan 11, 2020, 8:25 PM UTC

ubercow13 wrote: post #153

theonething wrote: post #116

Earlier quoted context omitted.

> account recovery, as a sole factor, meaning you're substantially worse off with SMS authentication than you are without it at those services But if in those cases you disable SMS auth, then you can't recover your account right? That might be considered worse off in some cases.

What worries me isn’t that I might not be able to recover my account if it uses some other form of authentication, it’s that I might not be able to recover my account because it requires authentication from a phone number I lose access to.

This just happened with my AWS account. Changed phones and forgot to update the number. Didn’t realize it until it was too late. Their recovery process without the phone is incredibly onerous (as it should be) and way too much hassle for me to go through for a small personal account. I just deactivated the credit card that was getting billed and let the account get cancelled. That was a hassle, but not nearly as much as getting back into the account.

Re: SMS is not 2FA-secure

#329

Post by tgdnt » Sat, Jan 11, 2020, 8:26 PM UTC

Does anyone know the reason for all the Redacted entries on the interactive datasets?

Re: SMS is not 2FA-secure

#330

Post by offmycloud » Sat, Jan 11, 2020, 8:39 PM UTC

MrStonedOne wrote: post #285

Protip: security is not black and white The word "secure" is not binary. sms as a 2fa is secure. Just not as secure as a authy totp account ...which is not as secure as a unclonable totp system ...which is not as secure as a hardware token based otp system ...which is not as secure as a hardware token that also requires you enter a pin and a fingerprint to activate it and only communicates using hard coded encrypted…

To defeat the Authy account recovery process, you need to perform an active SMS attack (SIM swap, etc) and then prevent the target from seeing the recovery warning emails for 24 hours. Therefore, Authy customers should only tell trusted people that they are going on a weekend off-the-grid camping trip.